PGP CTO Blog

Coming soon: passports to broadcast personal data
22 Apr 2005

Imagine that you, an international traveler, discovered you were carrying a device with you that was a sort of James Bond tracking bug. From a distance of tens of feet to tens of yards, it would reflect a radar-like ping that announced its presence to those with computer and radio equipment. Up close, it would send more detailed information, including your legal name, nationality, a photo, and other confidential information.

The danger of such a bug is obvious. Con artists and thieves would know valuable private information and be able to target you in a crowd. Pickpockets would know which pocket to pick. Terrorists would know which café to bomb. When you discovered this device on your person, would you discard it? Would you call the authorities to report it?

Sadly, this scenario may become a reality, and none of these options will be available. The device referred to is a passport, and it was planted on you by the Department of State in the name of security. These new passports will contain new security-related information about you and a Radio Frequency Identification (RFID) tag that allows them to be read from a distance.

RFID tags are useful devices that are becoming part of the retail supply system to identify and track goods from suppliers through warehouses to consumers. They have value because they allow large amounts of product to be moved quickly and accurately. It is these efficiencies that have seduced the State Department into considering their use in passports. For example, RFID can speed up border crossings by scanning travelers as they walk through Customs much like a pallet is scanned and then shunted along conveyor belts in a warehouse.

Some security experts are concerned about the information the new passports will contain. I am less concerned about the actual information in the new passports than I am with how that information is made available.

Unfortunately, what is an appropriate use of technology for tracking bottles of shampoo is not appropriate for citizens. Although warehouses need to incorporate ever-increasing efficiencies, the reason to have a border is not efficiency. I have no love for standing at Immigration Control, but I accept there is a reason for that second word, “control.” The Customs official should look me in the eye, ask me a question or three, and use the power of human judgment to assess the threat I do or do not represent before letting me in. That official will also look me up in a database; however, when I"m being personally assessed is a perfect time to let an optical scanner look at two pages of ink. The RFID is expensive, unnecessary, and fosters sloppiness in the assessment process.

No less important, we citizens who travel must avoid a spectrum of miscreants ranging cheating cabdrivers through pickpockets and robbers all the way to terrorists. I don"t expect my country to actively protect me when I am abroad, but I do expect it to avoid putting me in harm"s way. I don"t need a beacon that is an advertisement for my potential victimhood, “Look, over here, an American! Need cash? Credit cards? Want to make a splashy political statement for the news? Act now!”

It is true there are countermeasures for these passport tracking bugs. The Office of Management and Budget plans to test how easy it is to read RFIDs from various distances. There is also discussion of how to make radio-shielded passport covers. Shielding itself is a simple enough technology; the difficulty lies in how to make passport shielding that doesn"t also set off metal detectors.

This problem brings us back to appropriate technologies. Two-dimensional barcodes can carry the same information as an RFID tag. They can be easily, reliably, and quickly scanned. The cost per passport is only paper and ink. They don"t break when sat on. There is no way to suborn such a passport at a distance, making two-dimensional barcodes the correct solution in terms of cost, reliability, and safety.

The present proposal for RFID tags in passports is so obviously wrong that other security experts have suggested outright malice in this proposal. I don"t believe that. I see nothing but smart people being blinded by clever technology into doing something foolish. Let"s hope the State Department comes to its senses before the stars in its eyes end up getting Americans robbed or injured.

Background Reading

Carey, John, "Big Brother's Passport to Pry," BusinessWeek, November 5, 2004

"Critical Facts About RFID Tags In Passports," Association of Corporate Travel Executives (ACTE), April 6, 2005

"EFF Urges State Department to Drop RFID Passport Plan," Electronic Frontier Foundation, April 8, 2005

Swedberg, Claire, "U.S. Tests E-Passports," RFID Journal, November 2, 2005